Person or Entity Authentication

Implement procedures to verify that a person or entity seeking access to ePHI is the one claimed. The standard at 164.312(d) has no implementation specifications, which means it is required in full: you must authenticate, and the method must be reasonable and appropriate to the risk you identified.

Authentication factors:
• Something known — password, passphrase or PIN
• Something held — hardware token, smart card, authenticator app or certificate
• Something inherent — fingerprint, facial or other biometric

Implementation approach:
- Set password requirements from current NIST SP 800-63B thinking: favour length over composition, screen against known-breached password lists, and stop forcing arbitrary periodic rotation, which drives predictable, weaker choices
- Deploy multi-factor authentication for remote access, administrative accounts, and any internet-facing system holding ePHI. The rule does not name MFA, but a risk analysis will almost always conclude it is warranted, and its absence features repeatedly in enforcement
- Authenticate systems and services, not only people: API keys, certificates and service accounts all need managed identity and rotation
- Lock accounts after repeated failures, and alert on password spraying and impossible-travel patterns
- Re-authenticate before high-risk actions such as bulk export or privilege change
- Never transmit or store credentials in reversible form; hash with a modern algorithm and per-credential salt
- Verify identity before issuing or resetting credentials — help-desk reset is a well-worn attack path, and social engineering of it is common
- Manage the full credential lifecycle: issue, rotate, revoke on termination, and review dormant accounts

• Authentication policy covering people, systems and services
• Password standard, including length, screening against breached lists and rotation position with rationale
• Multi-factor authentication scope, and the risk rationale for any system excluded
• Identity verification procedure for credential issue and reset, including help-desk steps
• Account lockout and failed-attempt alerting configuration
• Credential storage standard, naming the hashing algorithm in use
• Service account and API credential inventory, with owners and rotation schedule
• Credential lifecycle records: issue, rotation, revocation and dormant account review
• Biometric enrolment and handling procedures, where biometrics are used
• Authentication-related incident records

• Confirm authentication is enforced on every path to ePHI, including APIs, database tools and mobile apps
• Attempt authentication with a known-breached password and confirm it is rejected
• Verify multi-factor authentication is enforced for remote and administrative access, and attempt to bypass it
• Trigger the lockout threshold and confirm both enforcement and alerting
• Inspect credential storage and confirm hashing with a modern algorithm and per-credential salt
• Attempt a credential reset without satisfying identity verification and confirm refusal
• Review the service account inventory and confirm rotation is happening as scheduled
• Confirm credentials are revoked promptly on termination, checking actual timestamps
• Identify dormant accounts and confirm they are disabled
• Confirm no default or vendor-supplied credentials remain active